GCHQ’s bulk interception of communications data, including data about telephone calls and emails, unlawfully breached the privacy rights of UK citizens, the European Court of Human Rights ruled today.
The court’s Grand Chamber found that the UK’s regime of intercepting bulk communications data and obtaining data from phone and internet companies breached citizens’ rights to privacy.
The decision follows an eight-year legal battle by 11 non-governmental organizations (NGOs), including Liberty, Privacy International, and Amnesty.
They brought the case in the wake of revelations about the UK’s involvement in mass surveillance following leaks by former US National Security Agency (NSA) contractor Edward Snowden in 2013.
Judges also found the UK’s bulk interception program did not contain adequate protections for confidential journalist material, including their confidential sources.
However, they rejected claims that the UK lacked sufficient safeguards to prevent abuse when Britain’s spy agencies, such as the NSA, requested intelligence from overseas intelligence agencies.
Megan Goulding, a lawyer at Liberty, said the court’s findings showed that the UK’s bulk interception powers had breached the public’s right to privacy and freedom of expression for decades.
“Our right to privacy protects all of us. Today’s decision takes us another step closer to scrapping these dangerous, oppressive surveillance powers and ensuring our rights are protected,” she said.
The court ruling applies to the surveillance regime of the Regulation of Investigatory Powers Act (RIPA) 2000, which has since been replaced by the Investigatory Powers Act 2016, also known as the snoopers’ charter.
Goulding said the court’s decision would clear the way for a further legal challenge against surveillance powers under current surveillance laws, with a case expected to be heard in the Court of Appeal later this year.
The bulk interception regime lacked safeguards.
In a 200-page judgment, the court found that because of the proliferation of threats faced by the UK and other countries, the decision of the UK to operate a bulk interception regime did not, in itself, violate privacy rights.
However, it found the UK’s bulk interception regime had shortcomings under RIPA, which meant it was incapable of limiting the “interference” of citizens’ rights to private life to that “necessary in a democratic society”.
Megan Goulding, Liberty
Surveillance had to be subject to end-to-end safeguards, including an assessment at each stage of the measures’ necessity and proportionality and supervision and independent review.
It found that UK intelligence services failed to include search terms in warrant applications defining the kinds of communications liable for examination after an interception. The search terms linked to an individual were not subject to prior internal authorization.
The court found that bulk interception had been wrongly authorized by the secretary of state rather than an independent body.
Judges said that the Interception of Communications Commissioner (since replaced by the Investigatory Powers Commissioner’s Office) had provided “valuable oversight,” and the Investigatory Powers Tribunal provided a powerful judicial remedy for people who alleged their communications had been wrongly interfered with.
But the safeguards did not go far enough to offset the shortcomings of the bulk surveillance regime.
